# Error in config when logstash runs

**URL:** <https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171>\
**Category:** Logstash\
**Created:** [August 20, 2018, 1:02pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171 "2018-08-20T13:02:38Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![afs2r](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@afs2r](https://discuss.elastic.co/u/afs2r)\
**Post date:** [August 20, 2018, 1:02pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/1 "2018-08-20T13:02:38Z")

</div>

Hello,

First, logstash does not listen on tcp port 5544 as I mentioned in my config file...  
And second, I cannot figure it out : I have this error repeatedly (the end of config file):

> [2018-08-20T14:51:51,439][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, input, filter, output at line 35, column 1 (byte 1092) after "}

**File /etc/logstash/conf.d/afs2rParser.conf**

> input {  
> beats { port =\> 5545 }  
> tcp { port =\> 5544 }  
> }
> 
> output {  
> elasticsearch { hosts =\> "localhost" }  
> }
> 
> filter {  
> grok {  
> patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]
> 
> match =\> { "message" =\> "@timestamp%{NONLETTER}%{TIMESTAMP\_ISO8601:Date}%{GREEDYDATA}[%{DATA:Serveur}][%{GREEDYDATA}][%{LOGLEVEL:Severity}][%{DATA:Application}][%{DATA:Module}][%{DATA:Operation}][%{DATA:SubType}][%{GREEDYDATA:log}]"}
> 
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:Date} %{DATA:Serveur} %{GREEDYDATA:Application} %{POSINT} - [meta sequenceId="%{POSINT:sequenceId}"] %{GREEDYDATA:log}"} # Match a variety of any others
> 
> match =\> { "message" =\> "%{MONTH:month} %{MONTHDAY:monthday} %{TIME:time} %{DATA:Serveur} %{DATA:Application}: %{GREEDYDATA:log}"}
> 
> match =\> { "message" =\> "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}"}  
> }
> 
> geoip { source =\> "clientip" }
> 
> date {  
> match =\> ["Date", "ISO8601", "dd-MM-yy HH:mm:ss:SSS","dd/MMM/yyyy:HH:mm:ss Z"]  
> target =\> "@timestamp"  
> }
> 
> mutate {  
> rename =\> { "beat.hostname" =\> "Serveur" }  
> }  
> }

**File /etc/logstash/patterns**

> PLAYDATE %{MONTHDAY}-%{MONTHNUM}-%{YEAR} %{TIME}  
> NONLETTER [,\:"]+

**File /etc/logstash/logstash.yml**

> path.data: /var/lib/logstash  
> path.config: /etc/logstash/conf.d  
> path.logs: /var/log/logstash

logstash version : 5.6.10  
Centos 6.10

Thanks a lot for your help !

Pierre

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 1:06pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/2 "2018-08-20T13:06:05Z")

</div>

Do you have any other files in /etc/logstash/conf.d?

---

<div class="post-metadata">

**Author:** ![afs2r](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@afs2r](https://discuss.elastic.co/u/afs2r)\
**Post date:** [August 20, 2018, 1:06pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/3 "2018-08-20T13:06:42Z")

</div>

No ! 🙂

---

<div class="post-metadata">

**Author:** ![\_Alex](https://avatars.discourse-cdn.com/v4/letter/_/54ee81/32.png) [@\_Alex](https://discuss.elastic.co/u/_Alex)\
**Post date:** [August 20, 2018, 1:18pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/4 "2018-08-20T13:18:49Z")

</div>

In your second match you may need to escape the quotes `"` depending on your intention:

```
[meta sequenceId=\"%{POSINT:sequenceId}\"]
```

---

<div class="post-metadata">

**Author:** ![afs2r](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@afs2r](https://discuss.elastic.co/u/afs2r)\
**Post date:** [August 20, 2018, 1:24pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/5 "2018-08-20T13:24:27Z")

</div>

Ach the quotes are escaped, but backslash were removed in the post...

---

<div class="post-metadata">

**Author:** ![\_Alex](https://avatars.discourse-cdn.com/v4/letter/_/54ee81/32.png) [@\_Alex](https://discuss.elastic.co/u/_Alex)\
**Post date:** [August 20, 2018, 1:41pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/6 "2018-08-20T13:41:12Z")

</div>

Okay! Another thing I can see is that you've defined patterns to be located in the conf.d directory:

```
patterns_dir => ["/etc/logstash/conf.d/patterns"]

```

But then listed the file as `/etc/logstash/patterns`. Maybe the inclusion of the patterns file inside the `conf.d` directory is causing problems (as @magnusbaeck eluded to). Moving the patterns file to live in `/etc/logstash` instead of the `conf.d` directory should resolve this.

---

<div class="post-metadata">

**Author:** ![afs2r](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@afs2r](https://discuss.elastic.co/u/afs2r)\
**Post date:** [August 20, 2018, 1:59pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/7 "2018-08-20T13:59:30Z")

</div>

Yes seems good !  
Thanks a lot !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2018, 1:59pm UTC](https://discuss.elastic.co/t/error-in-config-when-logstash-runs/145171/8 "2018-09-17T13:59:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.